Download the PDF

In a world where the only certainty about the future is uncertainty, a risk management culture that permeates an organisation will allow it to be more responsive and create real value.

Many companies practice risk management to address the threats that face their capital programmes. However, they tend to do so for individual projects rather than holistically across the capital programme or an overall organisation level – and solely do so to avoid or reduce threats.

All too often risk management is not ingrained in the business’s culture and philosophy and that limits the value of the practice. People need to change their perception of risk management being a compliance requirement to providing a way to add value through reducing threats and maximising opportunities.

Risks do not solely happen at a project level. An organisation can face risks at all levels or have recurring risks across the project portfolio. An energy firm building a series of oil pipelines in remote locations, for example, will need to manage similar risks for all of them: how do they get the equipment and people to the site? What are the environmental considerations? Will the supply chain get the pipe delivered in time?

Less defence and more offence

Generally, risk management is often synonymous with risk prevention rather than value creation. It has historically been more about defence than offence, which does not work when there is so much uncertainty.

Effective risk management also means identifying potential opportunities and using them to maximise the probability that the company will be able to benefit and the value it provides. For example, when there is a market downturn there is often an opportunity to buy materials and services cheaper than normal. A good risk management programme will look for ways to maximise the value that can be achieved from that situation.

In fact, companies that embed a framework and ethos of risk management into their culture across the organisation can be more agile in identifying and responding to risks, resulting in greater value to the company. In uncertain times, having a strong risk management culture allows companies to take on risky ventures with the confidence that the threats can be identified and addressed prior to negatively impacting the outcome.

A robust culture of risk management across the organisation will also ensure that the business needs are at the forefront so projects add real value to the company. After all, a ‘successful’ project that meets its targets but no longer meets the business’s needs is a business failure. Projects are implemented to meet a business need, but business needs can change.

Embedding a programme-level risk management culture

It is important teams understand what the organisation’s priorities are for the programme or individual project, how risks will be managed and the level of risk the organisation is willing to assume. Although this strategy will likely be unique for each company as it will address the various aspects of their business, including the industry, products, structure, size and many other elements, there are some key factors that need to be in place to help successfully embed change:

1. Risk is everyone’s responsibility

Don’t think of risk management as a chore and only the responsibility of the risk manager. Everyone in an organisation needs to incorporate risk management into their daily activities. Done right, risk management will move from simple compliance to a genuine business responsibility for everyone. An employee helping to manage the supply chain will incorporate the risks associated with each vendor regarding late delivery and quality, and make recommendations. The team would then implement risk response actions to help manage the threats, such as increased inspections, contract incentives or penalties.

2. Understand the organisation’s philosophy for risk

Understand your organisation’s objectives, priorities, and philosophy to risk management. That way you can be more proactive in making decisions without needing to consult upper management at every stage. In today’s fast-paced environment, organisations need to make better decisions faster. Empowering staff at lower levels to make decisions and giving them information about the organisation’s priorities and how it wants to manage risks, will ensure better outcomes.

3. Communicate the importance of risk management from the top-down

Make sure senior management understand their key role in communicating the importance of risk management throughout the organisation and provide the proper knowledge and training on making risk-aware decisions. This communication includes demonstration that risk management is embraced at all levels.

4. Target ranges rather than fixed points

Using quantitative risk analysis outcomes, establish a range of acceptable cost and schedule outcomes rather than a deterministic number across the programme. Having target ranges rather than fixed points provides the team with flexibility in how to best meet the organisation’s priorities.

When done right, risk management is ingrained in the fabric of the business and is not a project-based, check the-box process. Most importantly, it adds real value to the programme and the company as a whole, through either improved performance for the project or programme or through improved lifecycle performance of the asset for the company."

From programme to project

Planning and managing risks more effectively at the programme and organisation levels means companies better manage issues on each individual project. This holistic overview allows companies to identify risks during project development where those risks might otherwise have emerged after the project began.

For example, don’t wait until the contract is signed before you understand the commercial risks involved in putting up a hotel in a new country with new regulations. Developing best practices across the organisation on how to manage risks when entering a new country and how those may be reflected in contracts will help avoid repeating mistakes and expedite the time required to address such issues.

Companies have limited capital and need to select the projects to progress that will add the most value. Companies typically prioritise projects based on the estimated return on investment or continued operation requirements. Yet, they often fail to consider that estimated returns may have significant variability associated with them due to risks. Without consideration of the risk impacts, the company may select the more risky project when really another project offers better value to the organisation. Using risk-based decisions allows companies to determine the most efficient use of their capital – and doing so at the programme level is the best way to make those choices.

The benefits of embracing risk in a programme

Managing risk does not mean taking chances; safety risks are never worth taking, whereas commercial risks (e.g. pricing, costs, supply chain) might be. Rather, it means having a strong system for identifying what those risks are and establishing an effective action to respond – to either add value through opportunities or minimise value reductions from threats. The important aspect is to know what risks an organisation can afford to take and which they cannot.

In addition, problems can occur when organisations prescribe fixed targets or in detail how to manage risk, as this can lead to inflexibility and a culture of risk aversion. But a broad understanding of risk management throughout the organisation provides the framework needed to make informed decisions without forcing teams to avoid risks entirely.

When done right, risk management is ingrained in the fabric of the business and is not a project-based, check-the box process. Most importantly, it adds real value to the programme and the company as a whole, through either improved performance for the project or programme or through improved lifecycle performance of the asset for the company. A well-managed approach to risk can lead to better commercial choices, greater opportunities for the community at large and a healthier market perception (and share price) for an organisation seen as a risk-taking innovator.